From fa293316e679645e6397697428cee96e32e346fc Mon Sep 17 00:00:00 2001 From: Nataliia Solomko Date: Wed, 23 Apr 2025 15:11:16 +0300 Subject: T7181: VPP Static and dynamic NAT New CLI for static and dynamic NAT: ``` set vpp nat44 interface outside # multi set vpp nat44 interface inside # multi set vpp nat44 address-pool translation interface # multi set vpp nat44 address-pool translation address
# multi set vpp nat44 address-pool twice-nat interface # multi set vpp nat44 address-pool twice-nat address
# multi set vpp nat44 static rule external address
set vpp nat44 static rule external port set vpp nat44 static rule local address
set vpp nat44 static rule local port set vpp nat44 static rule protocol set vpp nat44 static rule options twice-nat set vpp nat44 static rule options self-twice-nat set vpp nat44 static rule options out-to-in-only set vpp nat44 static rule options twice-nat-address
set vpp nat44 exclude rule protocol set vpp nat44 exclude rule local-port set vpp nat44 exclude rule local-address
set vpp nat44 exclude rule external-interface ``` Settings: ``` set vpp settings nat44 session-limit # default 64512 set vpp settings nat44 timeout udp # default 300 set vpp settings nat44 timeout tcp-established # default 7440 set vpp settings nat44 timeout tcp-transitory # default 240 set vpp settings nat44 timeout icmp # default 60 set vpp settings nat44 workers set vpp settings nat44 no-forwarding ``` --- interface-definitions/vpp.xml.in | 293 ++++++++++++++++++++++++++++----------- 1 file changed, 212 insertions(+), 81 deletions(-) (limited to 'interface-definitions/vpp.xml.in') diff --git a/interface-definitions/vpp.xml.in b/interface-definitions/vpp.xml.in index 263f9cb91..b1ae348da 100644 --- a/interface-definitions/vpp.xml.in +++ b/interface-definitions/vpp.xml.in @@ -788,6 +788,98 @@ + + + NAT settings + + + + + NAT44 session timeouts + + + + + ICMP timeout + + u32 + Timeout in seconds (default: 60) + + + 60 + + + + TCP established timeout + + u32 + TCP established timeout in seconds (default: 7440) + + + 7440 + + + + TCP transitory timeout + + u32 + Timeout in seconds (default: 240) + + + 240 + + + + UDP timeout + + u32 + Timeout in seconds (default: 60) + + + 60 + + + + + + Maximum number of sessions per thread + + u32 + Number of sessions + + + + + Number of sessions must be between 1 and 4294967295 + + 64512 + + + + List of NAT workers + + <id> + Worker id + + + <idN>-<idM> + Worker id range (use '-' as delimiter) + + + + + Not a valid value or range + + + + + + Do not forward packets which do not match existing NAT translations (static or dynamic) + + + + + Physical memory settings @@ -842,73 +934,65 @@ - + NAT44 + 320 - + - Source NAT setting - 320 + NAT interface setting - + NAT inside interface - any + - + NAT outside interface - any + + + + + + NAT address pool + + - Outside NAT IP (source NAT only) + NAT translation pool - - - IP address, subnet, or range - - masquerade - - - ipv4 - IPv4 address to match - - - ipv4range - IPv4 address range to match - - - masquerade - NAT to the primary address of outbound-interface - - - - - (masquerade) - - - + #include + #include + + + + + NAT twice-nat pool + + + #include + #include - + - Static NAT settings - 321 + Static NAT rules @@ -920,6 +1004,7 @@ + #include NAT external parameters @@ -940,50 +1025,6 @@ #include - - - Protocol to NAT - - tcp udp icmp all - - - all - All protocols (TCP, UDP, and ICMP) - - - icmp - Internet control message protocol - - - tcp - Transmission control protocol - - - udp - user datagram protocol - - - (tcp|udp|icmp|all) - - - all - - - - NAT outside interface - - - - - - - - NAT inside interface - - - - - NAT local parameters @@ -1004,6 +1045,96 @@ #include + + + NAT static mapping options + + + + + Rewrite source IP addresses on packets sent from outside to inside + + + + + + Rewrite source IP addresses on packets sent only from a local address to an external address + + + + + + Only apply rule for traffic from outside to inside interfaces + + + + + + Force use of specific IP address from twice-nat address pool + + ipv4 + IPv4 address + + + + + + + + + #include + + + + + + + Exclude packets matching these rules from NAT + + + + + Rule number + + u32 + Number of rule + + + + + + IP address of the internal (local) device + + ipv4 + IPv4 address + + + + + + + + + Port number used by connection on internal device + + u32:1-65535 + Numeric IP port + + + + + Port number must be in range 1 to 65535 + + + #include + + + External interface + + + + + #include -- cgit v1.2.3